1

I have created my CA, Server and Clients certificates and keys. I have tried connections using sslmode flags with psql. I have edited the pg_hba.conf file to force SSL using hostssl only. Now I would like to set my server in order to force the verification to be sslmode=verify-full. I have read twice the documentation I and do not understand how to proceed. They say that it is controlled by an environment variable, but just cannot make it work. How must I set this variable and how would I make it persistent. Do anyone know how to proceed?

Update: I am runing a PostgreSQL 9.3 on Ubuntu Server 14.04

Improve this question
1
  • This doesn't make any sense as a server configuration. If you are connecting to spoofed server not the real one, it would just give you permission to connect to it without verification.
    – jjanes
    Commented Dec 23, 2015 at 17:30

1 Answer 1

Reset to default
10

Maybe you want to limit the clients to those which present a given certificate, as described in Using client certificates:

To require the client to supply a trusted certificate, place certificates of the certificate authorities (CAs) you trust in the file root.crt in the data directory, set the parameter ssl_ca_file in postgresql.conf to root.crt, and set the clientcert parameter to 1 on the appropriate hostssl line(s) in pg_hba.conf

On the other hand, sslmode=verify-full is a client-side feature. It benefits a client by ensuring that it connects to the intended server. It does not benefit a server as it's the server that is being checked.

Having a server being configured to "refuse to not being checked" doesn't seem to make much sense, as if a server would say "I don't trust myself".

Improve this answer
1
  • 4
    The server wouldn't say "I don't trust myself" but it could (if implemented) say "I don't trust clients which aren't properly configured, go get yourself properly configured". This wouldn't be of any benefit to the server itself, but would be of benefit to the people who run the server.
    – jjanes
    Commented Feb 18, 2016 at 22:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.